Service Management and Platform Capabilities
Services as first-class objects
Service Catalog registers services with ownership, metadata, and links to dashboards, monitors, and runbooks; Service Ownership maps those services to Teams. Software Delivery (CI Visibility and DORA metrics) measures deployment frequency, lead time, change failure rate, and time to restore from CI pipelines and deployments.
Incidents and automation
Incident Management covers declaring incidents, severity levels, timelines, and postmortems; Datadog On-Call handles paging and escalation. Workflow Automation triggers actions (Slack, Jira, HTTP, cloud APIs) from monitors, incidents, or security signals, and App Builder builds small internal apps on Datadog data.
Monitors
Know the monitor types: metric, anomaly, outlier, forecast, change, composite, APM, log, RUM, synthetics, and more. Key behaviors: multi-alert monitors group by tag, composite monitors combine sub-monitor statuses with boolean logic, and "no data" handling is configurable (alert, warn, or ignore). Downtimes mute notifications without deleting the monitor.
Access and governance
API keys identify data submission; application keys authorize API reads/writes and should be scoped to roles. RBAC, Teams, Audit Trail, and Organizations (parent/child orgs) are governance pillars. The Terraform provider and API are the supported path for managing monitors and dashboards as code.
Worked example: a latency monitor fires on a single pod restart; converting the metric monitor to a multi-alert grouped by service and adding an anomaly monitor on the aggregate reduces noise, and a composite monitor (anomaly AND not in downtime) prevents paging during scheduled maintenance.